dfc9c3d5c55af7d7f1c135c5fb4919e845f93684f334705677132420739752bc

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 10:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_a06a30b1d17c1af22a9b6eaa1e5fa225_glassworm_icedid_mespinoza_njrat.exe
Size 3.0MB
Sample261027-mklsaads7q
SHA256 dfc9c3d5c55af7d7f1c135c5fb4919e845f93684f334705677132420739752bc
MD5 a06a30b1d17c1af22a9b6eaa1e5fa225
SHA1 c50f0bb991d2fa42371dcbc663f0029e912c7763
SHA512 2968cce8859117f11d70476c95a0b17548d6ee8b749e8ecff3cd38e7f81fba3449eacdb84e09b25bf3acbe987c740b75efe1b84db2d3ca11a0dff973ab6841d3
SSDEEP 49152:C8s3gt9LoHwjvTLXewnfZOZaT/M+w6L6uRhTnZrCfQqNbME8osJHW1R:COvLSwcZMw6L64EfdbB8hW1
TLSH
T1DCE5F24773E6C0D8DFB781F6C9315222E671BC110B388AEB65A0962EDFB39905B36711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
2488	elevation_service.exe
1264	maintenanceservice.exe
2116	OSE.EXE
4544	perfhost.exe
3212	SensorDataService.exe
3928	ssh-agent.exe
4732	AgentService.exe
5524	SearchIndexer.exe
692	PerceptionSimulationService.exe
5300	ReFsDedupSvc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-26_a06a30b1d17c1af22a9b6eaa1e5fa225_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-26_a06a30b1d17c1af22a9b6eaa1e5fa225_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-26_a06a30b1d17c1af22a9b6eaa1e5fa225_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-26_a06a30b1d17c1af22a9b6eaa1e5fa225_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-26_a06a30b1d17c1af22a9b6eaa1e5fa225_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-26_a06a30b1d17c1af22a9b6eaa1e5fa225_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-26_a06a30b1d17c1af22a9b6eaa1e5fa225_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-26_a06a30b1d17c1af22a9b6eaa1e5fa225_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-26_a06a30b1d17c1af22a9b6eaa1e5fa225_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\System32\SensorDataService.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e2fe3bc73a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-26_a06a30b1d17c1af22a9b6eaa1e5fa225_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-26_a06a30b1d17c1af22a9b6eaa1e5fa225_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\snmptrap.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-26_a06a30b1d17c1af22a9b6eaa1e5fa225_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\GameInputSvc.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\system32\locator.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-26_a06a30b1d17c1af22a9b6eaa1e5fa225_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-26_a06a30b1d17c1af22a9b6eaa1e5fa225_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AgentService.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-26_a06a30b1d17c1af22a9b6eaa1e5fa225_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-26_a06a30b1d17c1af22a9b6eaa1e5fa225_glassworm_icedid_mespinoza_njrat.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1244-0-0x0000000140000000-0x0000000140307000-memory.dmp	upx
behavioral2/memory/1244-85-0x0000000140000000-0x0000000140307000-memory.dmp	upx
behavioral2/files/0x0001000000009396-269.dat	upx
behavioral2/files/0x000100000000a1d4-332.dat	upx
behavioral2/files/0x000100000000a0ce-331.dat	upx
behavioral2/files/0x000100000000ba34-330.dat	upx
behavioral2/files/0x0001000000006215-329.dat	upx
behavioral2/files/0x0001000000009b92-328.dat	upx
behavioral2/files/0x0001000000009fd4-327.dat	upx
behavioral2/files/0x000100000000b96b-326.dat	upx
behavioral2/files/0x0001000000009cfe-325.dat	upx
behavioral2/files/0x0001000000009cd6-324.dat	upx
behavioral2/memory/1244-323-0x0000000140000000-0x0000000140307000-memory.dmp	upx
behavioral2/files/0x0001000000009952-320.dat	upx
behavioral2/files/0x00010000000093de-319.dat	upx
behavioral2/files/0x000100000000934f-318.dat	upx
behavioral2/memory/692-415-0x0000000140000000-0x000000014018A000-memory.dmp	upx
behavioral2/memory/5300-441-0x0000000140000000-0x0000000140388000-memory.dmp	upx
behavioral2/memory/692-454-0x0000000140000000-0x000000014018A000-memory.dmp	upx
behavioral2/memory/5300-455-0x0000000140000000-0x0000000140388000-memory.dmp	upx
behavioral2/memory/5300-463-0x0000000140000000-0x0000000140388000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	OSE.EXE
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-10-26_a06a30b1d17c1af22a9b6eaa1e5fa225_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-26_a06a30b1d17c1af22a9b6eaa1e5fa225_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-10-26_a06a30b1d17c1af22a9b6eaa1e5fa225_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-10-26_a06a30b1d17c1af22a9b6eaa1e5fa225_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-10-26_a06a30b1d17c1af22a9b6eaa1e5fa225_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-10-26_a06a30b1d17c1af22a9b6eaa1e5fa225_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-10-26_a06a30b1d17c1af22a9b6eaa1e5fa225_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-10-26_a06a30b1d17c1af22a9b6eaa1e5fa225_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-10-26_a06a30b1d17c1af22a9b6eaa1e5fa225_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-10-26_a06a30b1d17c1af22a9b6eaa1e5fa225_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-10-26_a06a30b1d17c1af22a9b6eaa1e5fa225_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-10-26_a06a30b1d17c1af22a9b6eaa1e5fa225_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-10-26_a06a30b1d17c1af22a9b6eaa1e5fa225_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	OSE.EXE

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-26_a06a30b1d17c1af22a9b6eaa1e5fa225_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	PerceptionSimulationService.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000088088b66fe65dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e384fa5fe65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000db15864fe65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000004256cb65fe65dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001ea49465fe65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000035167964fe65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e6e63ca5fe65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2488	elevation_service.exe
2488	elevation_service.exe
2488	elevation_service.exe
2488	elevation_service.exe
2488	elevation_service.exe
2488	elevation_service.exe
2488	elevation_service.exe
2116	OSE.EXE
2116	OSE.EXE
2116	OSE.EXE
2116	OSE.EXE
2116	OSE.EXE
2116	OSE.EXE

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1244	2026-10-26_a06a30b1d17c1af22a9b6eaa1e5fa225_glassworm_icedid_mespinoza_njrat.exe
Token: SeAssignPrimaryTokenPrivilege	4732	AgentService.exe
Token: 33	5524	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5524	SearchIndexer.exe
Token: SeDebugPrivilege	2488	elevation_service.exe
Token: SeBackupPrivilege	5300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5300	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5300	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5300	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5300	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5300	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2116	OSE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5524 wrote to memory of 1060	5524	SearchIndexer.exe	96
PID 5524 wrote to memory of 5492	5524	SearchIndexer.exe	97
PID 5524 wrote to memory of 720	5524	SearchIndexer.exe	98
PID 5524 wrote to memory of 5292	5524	SearchIndexer.exe	99
PID 5524 wrote to memory of 1648	5524	SearchIndexer.exe	103
PID 5524 wrote to memory of 4016	5524	SearchIndexer.exe	104
PID 5524 wrote to memory of 3432	5524	SearchIndexer.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-10-26_a06a30b1d17c1af22a9b6eaa1e5fa225_glassworm_icedid_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_a06a30b1d17c1af22a9b6eaa1e5fa225_glassworm_icedid_mespinoza_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1244

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2488

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1264

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2116

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4544

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3212

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3928

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4732

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5524
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1060
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5492
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3068 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:720
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3032 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5292
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1648
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3032 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4016
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3068 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3432

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:692

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b450e5b188837e2cde5f3f8eccbd6a5c21671b1db9525a7fd1ab5d775dc27af4
MD5 e0e5e5facd994e91708467fe59ed2bc9
SHA1 234eaf610fb6a98fe2134195c55ac2b7ae517530
SHA512 017c36f740a3f6b64ab81b7037a600a3a9fc9e4903bb159f88cb7ded30d1e59eb9f89a2e61779c435822da821ccedeb92babe03390096094b944e804b4fe5f8e
SSDEEP 49152:zb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnJT/M+w:R3q6HjBaw
TLSH
T173D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 ddf1c429ffb26f31481d4e5125da6921c0401a9aff5e1d845b677be59ffe4385
MD5 53313b1fc1e0f60ffa340da5527b6575
SHA1 f32a74de8cfef0a1b4e32a2d99644e35178c56d1
SHA512 7ec23a55e8e32da96aa0eaf5a7d831ea7cecca443b190aa4b0bd21195bfbaba52c5bc3569769b0406a37e93236cbf4336ec371141d71c7e5c284ac5e5d8c926d
SSDEEP 24576:CXYfDtczAboHjto1GFxlXutIs1WZX5AR:Jtc3T/M+w
TLSH
T1E085F12977E108F9ED678178CCA38511EA73B8554760E6DB03E4D9290F332D86E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 58ee8e9c79e43d8064c1391288e72dfacbdc961ed3722a572cda115b5db6f173
MD5 ea8ead36b85fa4535d67bce7b5a96eef
SHA1 1316610d105e48af09afc70eaf23505ba6a14543
SHA512 8015c4fc01609c308967f9fbee68fe6c0f6971b4b7f76005a25c45a17588e4966cd2aea6048c50c8c8c5422211c77c23db197862a2c4acbb2c547931aa17a189
SSDEEP 24576:b0Le5ji0hmxIrMgoHjto1GFxlXutIs1WZX5AR:bPji0AGGT/M+w
TLSH
T123959E26F5748375D073C0B9C5D3A69AED7230861B308ACB4286D77C2F676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 dc034629f38c0132ce64465770424ce6d3df3aea468a96292efc18e2c84c3e1e
MD5 975465251bc39d3c049386c0d45cffa2
SHA1 8944a179fad0961256c1c4ae685f59f375a5d9ed
SHA512 0cc299cbb22f7b3eb69c9bc7095417c2f949c0ae0f9849ed6da4a56e38458dbc690e1977b13975b7d3e05504a276299e445272c4875a944b111f10750b5d5ca7
SSDEEP 24576:da7/ezSC6vUyD/aqgrvWE6q8wyumoHjto1GFxlXutIs1WZX5AR:U/ezSC6vUzPvxHjyaT/M+w
TLSH
T16D756C25F5788323D0B2D0BAC5D7BA99FE7230465B3089CB0246D76C3E276E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6aacef40e0ce50efabce8eca7e4e17d204e8d24aa50f86640d256265c7c556e4
MD5 ac6d1e9037e50c79910671a4cabbba9a
SHA1 9b00619979b0226275d21a086b0e7542f6199234
SHA512 3035d5f1756d7b672d42ee97b4fc278ef34198319ce63a39740c743679239e2fb14ee3272a3dffe3d2f3a3deaa438df58290cd72d4f36acdc44096e15931e07c
SSDEEP 24576:eVbqPb88hv/l+6/oHjto1GFxlXutIs1WZX5AR:eVO88hXl+VT/M+w
TLSH
T118559E66F5B48331D073C0B9C5D3AA9AEE3234425B318ACB1246D72C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 60e407312e4be032a3c20a4d4fb287780b3d625ddf15f91a2905e6c79ade0e25
MD5 dba64c42935e21951e8b3d01ba113bdd
SHA1 459e34355a2628b67953442f77503eed6d772a34
SHA512 ddf2967cf8f3a4076bbf5cc1113028df6b433ecde1b35c958cb77262a072f4cf0ae54006d68a85412aa093aeb22ef8b85a96ec5016d4f7ff2a1bc8ed2761b2cb
SSDEEP 12288:JH+hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERYdN:JHkoHjto1GFxlXutIs1WZX5ARgN
TLSH
T1EB65236399F250D7F77A11B02DD77AA1ECB7BB06094824BB4B50FE190E3C060EA766D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 6bbc3527e82002dce5c7dfa6d6f50d5fcce7089aca9d584b6ce23e1a8b8f34a7
MD5 cfda2ee6139700e82c30c967f4614c90
SHA1 15fd46949195ce523db4a27696590c58a5b220d1
SHA512 14f0eae137b007035be2d770c2488396b074a243f2014e6cc4f0ed11a60e4a08a7fa7e892148c980c87afc6a96f47963324b0b0edda876707fcbb33130e83554
SSDEEP 12288:seBNUbTVO86UxhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX5Z:sJIUXoHjto1GFxlXutIs1WZX5AR
TLSH
T1C385CF3BEE38FCD2C27A5DB85A928640E77274314F51A3CBD164C20E9E275E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 51c4b46300235b611deb801942f19b7129b47f68310c2b82e20a808595db3b0e
MD5 4462c78dd03b2c5c3fbf65698c10fa26
SHA1 38e8741943f424cc72ea70ee56543e07a3b7920b
SHA512 46120fe03f4fc8c1fb4033388d26dfe54e22b695f60dfe0bd4513062c6d0d3adf47b91233b20d2107e5d6c6ebd159e7157c009ecda73f260c11bc60e1d3dcce6
SSDEEP 49152:BQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THp:BQvGAdlCEL8c/yRNw5C7w
TLSH
T1AB266C656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 70c7b81b0e07f4ecc60e9687a420dc1589c6421ba08191be92f8c983a7a5f9ae
MD5 0e3292ed4ae540f042716f7ff063a1b7
SHA1 60706155b60ea07161676b7c8692a177c59219e4
SHA512 3b929121b4361c108d3d8527e5eaff4439f5ff854ecc8ec820376fecca1b941e25109d396201dbd9ee068f5392eab5b8f4123de29350ed21765e5b9a6d3af4c1
SSDEEP 24576:C7ewsAjloHjto1GFxlXutIs1WZX5ARRN:wlj2T/M+w
TLSH
T1BF85E031FEB0E036C37B0DB12B26D716687DBA204B5119C3E3E89E9E49341D22776A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 35155ed3efd1815ed23aabd9e169bc93b06aab169ffe14d4313b5f60d1b8a8e9
MD5 50baa684639f68c0e0fad859e0fd8fd9
SHA1 f40d38effce167f2e9fa07bb4402da35846a67d9
SHA512 d862c21817c9b62e056358a58d34e2b446529c2ed0566a67426d9e062933c63aff0a72b99479214887a6c576a6a05ca98e7ed64659d28f8752657ae3c5e0f83c
SSDEEP 196608:wUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHP:wUEtQevvqc2W1cpV2EI32
TLSH
T176474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3dcb3e65f43d4aa658f2c799015e8cce7276436b084b794acde068e9f4eb3fee
MD5 7356b70801b0d3253b3db0c17d26ccb8
SHA1 8f9cc518905b628fb063ea14fb569d0ce404391b
SHA512 688e0be7ed1c4a59d2914ac133e2d927f2a18c5ce09aa791bdc7ddcdb04d41d121771762046cce721a23ae0165a08373a31643fed6bd929b2a5530148740df46
SSDEEP 49152:gCbRquA/m2yL5zQfFiV+XenmE3/zWT/M+w:poqtVjnm3w
TLSH
T1CED58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 09e30c86bcedafefad027352cd3107eff4495980996a754d3d2eb5812b83cd71
MD5 dc9bcd68a2c3a144c0a5d34a5aab9c70
SHA1 a0aee1b19ef98232e34543cd6d62d62454bf15ee
SHA512 1383289a883b3cdc24f687d1296097ba305dd47ca65168a7c5fe5e9ab708430b79b26c9f1e55e668b5c440497d6dbf4302c9431e1d9f16012f6e616465f0089b
SSDEEP 24576:4AhGLJIFoiwtA5l7S53SoHjto1GFxlXutIs1WZX5AR:4AMyFoiq57T/M+w
TLSH
T14B35AD81EBF955D4F5B3AAB899B69170EA77BCA65E30C20F2150D11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 f6eeaee53f32239c9d25039ef715233cd945036755b3aefe537e5f0fe5d73921
MD5 9ba51daac92a5855aa7922d49c05fb10
SHA1 60f5c144d974c5cc07c73e3a237f3656affccf5c
SHA512 8049799faf6360e49aa5cdb5fc76d2c143b6f306c01b1566ed3ee53926ff19ad9015df4ae0ace81034c9ee7911f467026503c34f752f5c5f988a1822a76a92ce
SSDEEP 12288:qmw5HEjsChNDBFgl0WDm+C0hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09z/:jwuiOWhoHjto1GFxlXutIs1WZX5AR
TLSH
T17985F14676E50CF9E96781388597D536FBF3B8022A25D72F0760CA1B5F37220BD29B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 69489e84a4c57b80a9ffade2355cf349683f3f20d81c052ab84022280a3d2832
MD5 f1594a7c387966eaed69e3d04dac0fa1
SHA1 4c0271d60536844e170cf852827a9ca3a3e91868
SHA512 2e1eceb42ee1c15f8715e4b061e9fba217dbab7042f1d3824b69e0c0fe3fc8c2a385982b47d3622c04cf7c03828ba1b5225e6c134bcff41a8c401f0a871b6c18
SSDEEP 12288:mTZ1IyLhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:iZu4oHjto1GFxlXutIs1WZX5AR
TLSH
T1BE75125626F020FAE2A752789DE36A55EBB3B013173503DF06608A2A0F375D16E39772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5fbf4a9ea5661e9b6b3b8457ad78222ea59ad6b46b1a547683761cdc9524dbbc
MD5 ac4f5e6b44e8e8384025e3a02e1ff456
SHA1 78ffae97f2c8fb7d8d3917e91312bf039299d1ee
SHA512 d1499b0b614c1d61f052a4d67113c313b63eae1d99ede041198121731ddc7db638ddf27ad6a8ae3a37fa42010d45da827d2939be886f79b3f5f28dc05a12d44f
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UF:5QRQyi36YOcPQLvw2gAf+PN3uw
TLSH
T1FF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1588471315aef9dd3607b6317bed1944ece30fd4e393fb144b80cddd033eb27c
MD5 d339b44cf72d4b246a519c2810adf8f7
SHA1 9d0c3996ed7ca1194ca34f648729bfb3755dc30b
SHA512 9e8f56a1abf1fef9b708569805d5d4e0afc3235891beb12351da576afc9892707767179eb75dd743517c91fb2675994ad261ef1510cd6820f43d61474319a5c5
SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UF:yQRQyi36YOcPQLvw2gAf+PN3uw
TLSH
T1BD667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 631564d70e9e0341153c7c82c161d78518fad8a5ead0016c3f4fda99f078f846
MD5 07371e843e8b8b0a589743f43f22b9de
SHA1 5ac756423da9c5acbedb2591931a6885b043b714
SHA512 556df3422041d306b0591e3be4152adbd69fcf32106d5d784a4898904b9fde13dcc1b3d1c5eeb9aef2910091b4f5250777018429c5b01700b4d25734afb7870d
SSDEEP 24576:nwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0ooHjto1GFxlXutx:P68Qg55nhheWu7PNU3/GT/M+w
TLSH
T109B54933B2F20099C44DE1769F4A973196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e0a0847c1d8f8b2392b19b3a6c30ed5c5bacae9c35b373943b99cd12fc329e54
MD5 268dd2449417e520e8bd4ae6e226c72c
SHA1 b6a0bc8fa3650a35b111c4fd2b2fcdb31be1f86e
SHA512 75fda2d2c067b8693496dfb9ce8e92580aa6731e2bb59a01e5ffb559967f0e137bf6b0906d4ea222ae44ea4d4e3a3d4a73c4e73137ec9e3fde1fa0d65c17c3b2
SSDEEP 49152:O3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99H:vy5112gYy5azzVvL69nLKnhZRw
TLSH
T1AA167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 3.5MB
SHA256 ffbf3e74f3545d12b0355203bce1e48cded0194a3f7163412d6f567f637efa3d
MD5 036cff3309ddf944897c59240e341ad0
SHA1 af6ebb76211cb816337f4ee949c30eb27f4fd46d
SHA512 afa39bfc9a0164230c72c13adc46060a811eeedc203b5de1c5163af035941ad85c45bdf95b05999e26cd2b24f050c57e962ead84097c5fe40879964d029695d7
SSDEEP 49152:yB+taZ3usBWOBr4tEG30bqx0z+n217aau1glZL6uRhTnZrCfQNT/M+w:Au6JmZxd2dZL64Efsw
TLSH
T19606BE13F1DA01E8D05ED178974A9233F962BC490B35B6EF0A9073562A77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 cfa11f63045a2cc36bf867c8ba5692dbbc0f9920eaaca5c35b4f5386588b9ab6
MD5 2f1803d7d0a454db139fa95efb115ace
SHA1 dc4e233c0e3797b849c8f2170264c49e117fb773
SHA512 f76574c90fe551608c7b7cbd329ab514ec0a97a5de8204d18bafa902370ec449d953abb60a10dd3e3c277dad797bde374c68aaa529f6221e8c8288563c597bb8
SSDEEP 24576:7hv8E1hps0+ogd2z615uCMVF1Agz6bUQ1zNOgLLwH7ReaQXx3HoHjto1GFxlXutx:R1hpsNoJpF1A6UU44CwH7R4xYT/M+w
TLSH
T1F4B5AE13F2D900E8D06DD17887569632EA62BC460B34B6DF0A90B7961F7BAE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 73a0a80bb035725fe431042378dce58d4d34f6a4178310afeee2fd5293529546
MD5 2f540c2399642eaa88a19415cac98024
SHA1 5d1b17f7fac60c25ac184ee78f35be7eaa23211a
SHA512 42e408335ef708215734973ed9562f86fddd0ea28b37acfdf255471268b4ba75cf72490e8fa37a650e19ec6ac6c17dc0d5bb8280854f76583ea30f80647de15b
SSDEEP 24576:O4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6WR04FxGgVG2Onks6xt4bSMHnq4oHjto1z:SSuZQIY0Be2KRRVtOnks6NMHq5T/M+w
TLSH
T1A9C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5607a3bcf2e8febb44a2361db20d88f0eadcf874b242927cdd849c5728ae358a
MD5 6405fe06e1b2e95d43e2a22ac2784d50
SHA1 2bb8d10cd525abc3ed7f72bdbffe96b607b88745
SHA512 de22bfc5fc4e1c5b14294bf95c952faaf0d71a8071d6f35adf579edb2d8b0f3b51cf277a8882cb7ed005e6ad9222aa2ba8c956f7cc8c296a9659805272da59e9
SSDEEP 24576:uhiavrPSLT8EARn+FgyUgd0fJY6Bni3iy9CTn0AP5+2QLHoHjto1GFxlXutIs1Wg:uhtSn8EApI0figngiDn0AP5wkT/M+w
TLSH
T16E95BE13F2D900E8D05ED178C7468632E962BC160B39A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 50d07548c910ed6fb6f9280eee08774dcbf5f45645395a8f25141021a0c4e3eb
MD5 af49486847a683e88cdaa2aa7c403737
SHA1 457c4a1dd4c5cbf22cfec1eddcff84c4f19fc3be
SHA512 36a2959730c2d706ee684b32bb1dfc3cf2db58091d44b031f05f1b839fddb5156e673d3e579754a4fa05aca0c736080124d7e47723b95bcdea87bb9957dd8be4
SSDEEP 12288:m2hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:m8oHjto1GFxlXutIs1WZX5AR
TLSH
T1156523639CF340C7F62551B069C77AA1ECBBB347594920BB8B50EE190F3D064BA766D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 d330d3bd5fc0e35c56608d566ebc35cc7192d99746cffeb867e73ff97a76214b
MD5 26e5da539e62c1da7a74c7d6de64f9d0
SHA1 32b8b9395e626eabb86bdb7478628b0099153567
SHA512 de362cbd70cec66c8fa812174a945be21bebb0469d789a0efbaa00b492f038d02385ee05a4c540ec344c5d779b3966350a9df46e97576145d9d28648a3e93708
SSDEEP 12288:ZvhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:ZpoHjto1GFxlXutIs1WZX5AR
TLSH
T1BD652363ACF340D7F62551B029C76AA5ECBBB307594920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 d6779ed6f9160af0b21086ed312954c7e08ca90e3a9aa841009bcb20b2b5fb96
MD5 9cc580a69a72deeaf61cbfc8e1cd3f0a
SHA1 0c29adc1f7d3f72b3c75c6caafe4852c6c2602d3
SHA512 3139060d0045a44831624c8d9aaa127d320753c382c64989f9fd811335d8bf8d612f4d11a02b3ef2d8691900fc5475c9c66bab12c8946c667bcdd3d7adc9d960
SSDEEP 12288:hphKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:hvoHjto1GFxlXutIs1WZX5AR
TLSH
T1066523639CF340C7F62551B029C76AA1ECBBB347594920BB8B90ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 c31ac987d459ca546c9f62e9b7a5c56bcbfec6eea805bd08a247eec0847b50f7
MD5 7525c60d74cc2627158045e6332121a6
SHA1 dac162e85c7893a28c0fab499e7552d94da1a34a
SHA512 1601424f4148aa7f956a1f6b7c7eaa178841803320585d470390b12601c48d72c08be6d8e35166c8365ab8972884ff30cac5719e11a78714f400eedb5d689cca
SSDEEP 12288:dVAhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:qoHjto1GFxlXutIs1WZX5AR
TLSH
T1CE6523236DF200C7E53692B49DD36661ECB7B6465B2521FF8B009D1A0F391A0BE75BE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 d39b3b424e323d216d81d888c9f37c407e88db30bf9a094a8a98129b743dea1a
MD5 6326c6680754f2c72aa5c245f6c1578f
SHA1 815f80e6554f5744ef98b4ce5e3e646d5fa47fbf
SHA512 92553d64f9d7edf24da402f6315c71cb3db050cda6e6de21f111b121ebf492cb18f112ec3a99af4e6b5d23ceee7cf00be86f8518c8a9194b3af11b4d00142f23
SSDEEP 12288:sohKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:saoHjto1GFxlXutIs1WZX5AR
TLSH
T18E6523639CF340C7F62551B069C76AA5ECBBB347594920BB8B40ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 25856e16c51dca2279f3759fa8a2a172b80fb1e5ecd4b27de2d2902ef870466c
MD5 794b8b3bdd279868c5226f5b532ea67e
SHA1 684af1fcc43ecb3478e7b587d813ad3c8eb4b041
SHA512 a646676c6a7aa7bea6374a86b8f5f38e7154d95f46e62415dc673a3f9dbf224da01c49453ed20fde5da34283120749677f698fa9e455d902e06e8ad062127158
SSDEEP 12288:eThKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:edoHjto1GFxlXutIs1WZX5AR
TLSH
T19C652363ACF340D7E62551B029C77AA5ECBBB347594920BB8B40ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 6b6a9cf346e9933445435a9e56e73121934569bb71cda85f94f561550d9739e0
MD5 45b4f5e4481d586a2139e491b0d66658
SHA1 55e48fa7d7c02ec8389875393261dba700df4d8b
SHA512 a043d5db87ee181cd8fb60394d9644c34922905f2ba0ac09d17cabbf41be7fbf8cfd1b8d5a05b50b0b85ad7dccfbeeba758e4d60039aa5931b864489aa368fd1
SSDEEP 12288:Z3hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:ZRoHjto1GFxlXutIs1WZX5AR
TLSH
T1646523639CF340C7E62551B02AC76AA5ECBBB347594920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 55d54a02f0987fb2728a0bffb46480aea517e6da52817db32b0be2eff02a8a25
MD5 ebad16501f8723177d54b8ffb1675a8e
SHA1 c034299668ae8ac5c1d9f3f4ae269803fdca9a39
SHA512 d6f57002800957a7fda35d75a30801d6b9073875ee921febd2ead548c1127f95671f7a0afdefa91e7d0ea1de1344ba48e3a92b5385685aba48deea8460856ba5
SSDEEP 24576:+ZM0zFVSOJoHjto1GFxlXutIs1WZX5AR:+ZM0zf+T/M+w
TLSH
T1AA8502A5B3A018F9EC67813DCD569916D5B37C1A0B60C65F03A43A2B1F373A01D3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 b3b78ca2d30c19f86fdcb214e48ce7b00777c73006375504e74031250f30ac42
MD5 75e84f0d0203dfd76c549db4de7680f8
SHA1 105a918abc3505e1a9f4d3b47cd4c3dacd10b933
SHA512 928ff3e92742350ea869ba9af8556ff833bca9c88edf103e5ecb9536ae040de0a268c1f135367e0eb52aec36da736fe91f094440e6f12af175e599678370f060
SSDEEP 12288:0ihKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:0IoHjto1GFxlXutIs1WZX5AR
TLSH
T1DE652363ACF340C7F62551B029C76AA1ECBBB347194920BB8B54ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 de307ce4a65e575599f40c715e0163f6e4c06364a54d5557629b1651ba00b22a
MD5 1176da213bc79375944a55a55e60df5a
SHA1 0083a24f2b0b7c847c2861c7a0af0a9599a3f5ca
SHA512 1f3b84ee92f48e566a967c5977ce776f491591f1c3dcea44d19257be56575208902c7f494a747018681b87f7c7cb0126446ae902c44632da4b2a254ba11ad7af
SSDEEP 12288:AuhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:A0oHjto1GFxlXutIs1WZX5AR
TLSH
T1FC652363ACF240C7F62551B029C77AA5ECBBB347594920BB8B50EE190F3D0647E766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 d7b8642c44b1a77ca08c5dc9afaaf9c4a1e925bee0dd039a59000fec9938866c
MD5 3ef072eff021c442fdf36c5a5d2a85d4
SHA1 2187d45d7ed83041164868a49e1496b28bcaba43
SHA512 7e6cfce0d447870853d611ca13832c168be4cab03bb205dad2f27f0bb48dfafa3af008950a3abf49c1b66449cd9f45647ab9d4d11a3ce411f3c2d30f7079486a
SSDEEP 12288:ByPz5L8LhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:Qzy1oHjto1GFxlXutIs1WZX5AR
TLSH
T15A75021776F130F9D13692748D931A51F777B43607245AAF47A04B3A1F372A0AE3ABA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 b416c2f6937a4622d082c6b01a464518fd6de470a6feed1d0da8848af296074e
MD5 721187db49ff096e13939adc86d07927
SHA1 64faa8c2631213dc8fa9a1bb62ef84d0e5708840
SHA512 c727fb469728f42aae1f710bb6642216aa5d4bb454d1e1fc1e6b1effc6225d24a53a4244bafb9b82950d872f8c49c0f3795c71e4de7c91403a3524513cf0d151
SSDEEP 12288:tihKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:tIoHjto1GFxlXutIs1WZX5AR
TLSH
T145652363ACF350C7F62551B029C76AA5ECBBB347194920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 95534d7f378a9c813d6f33d16901efb162cc092144ab0171fcaa222560347061
MD5 a4490e19f4a4e12b5d5769a3eb6b43a7
SHA1 779c1c7932c9c48f1550ac746e36cc5c205f7698
SHA512 be5c00b52c38051fb01f7573f1b23d7a27f6abc0939d94fb5c8bd46481dc58a2f5292ab7378c05c0f1c202922363ee25a0e74cafda7ae4d4e510471e730e47a4
SSDEEP 12288:VihKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:VIoHjto1GFxlXutIs1WZX5AR
TLSH
T17D652363ACF350C7F62551B029C76AA5ECBBB347194920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 0625603389504596266cbaeffb23685ff4591d58081da3cc1738bee7e97161ac
MD5 c521878d40e59f9ca5d219a96c65b34a
SHA1 a93cae8ab529ad6f26ee472b125af824be0e0e20
SHA512 051b2a0ba411df974c91889276c8a16e8bb4eccbadecd7f423288354887c55810e2b5b17efe20286c142c1551a4b4553a8d4b336ac34c1a50e41bc73333f7374
SSDEEP 12288:CyPz5L8LhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:fzy1oHjto1GFxlXutIs1WZX5AR
TLSH
T13275021776F130F9D136927489931A51F777B43607245ABF47A04B3A1F372A0AE3ABA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 6c0e951e5dbed0da2cde7e41763bba775c9395fce4004b24c877eced93567769
MD5 be6b508ea88ee8b588157629a20db0c8
SHA1 0df3d2f1a0ba4c37027c99053e9de751bd5c4c1f
SHA512 f245219c04fd186b8c2f5652492d941db450c1964bb545e45ddd8c26837dfb3f60a9d6f996151d36c87b93a7cad439321b29b35cc8f7b5a915efb9f4a4e42b69
SSDEEP 24576:0TNaLl3z0zDfoHjto1GFxlXutIs1WZX5AR:0TALljnT/M+w
TLSH
T19D8502A5B3A018F9EC67813DCD569916D5B37C1A0B60C66F07A43A2B0F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 02e5e723aa587baaf02156b56f14c49ee463c6bb35abace06f791f13db378ea4
MD5 b11bb50a7fc1f6f3410ad48070e250f6
SHA1 8d396554882e8d031bc43a70594cf4680d1f4835
SHA512 e7b5a8668b2dd16a3a868dd4b552f3de87c6c51c8fff35d61f95b02359be5717ca8157562679c4467e744cd50e143e4f3f1d9a4756cc6c3fc7d0e1edf9d1ab5c
SSDEEP 24576:H3pd9CHKy7GZToHjto1GFxlXutIs1WZX5AR:Xpd9CHKya+T/M+w
TLSH
T19395CF90F3E410E9F0B79A348D765512DAB77C5A1B31DA8F03A4661A1F336D18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 d029dd16ce56540ee00f9b33b1367a632305720b15b46074eec261d0d603bdb2
MD5 48c75aa284995c33194cae7ea4283770
SHA1 79120fabca52aad317a1b748a0bdb012b1586392
SHA512 72041a9460dd073c59720cbec04559d34874da1539042b7d6aed629af6f236d5bb8e94f1c5a24e445d0653213fb5c6e91c1c12fb3b371efdf401724d193c3295
SSDEEP 12288:rJhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:rPoHjto1GFxlXutIs1WZX5AR
TLSH
T1C5652363ACF340C7F62551B069C76AA1ECBBB347594920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 76bbb0734e380e48bab1c62d0bbf1bd785a2d08a7e4d5255c8495eae6ef703ba
MD5 2149af113d86a4fe89220e2a43b7870e
SHA1 c35b7adc5cb905c85f6c27da903a2f48231efbb4
SHA512 593eb31527f52cec783480ef5c50c73b9d389bd875264cbc076438efa2365a2261e7db59a9a58f94aad0d7f13fefebd53ce4bc07bf6ce7c4dbe93ad3055b3588
SSDEEP 12288:DrhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:DVoHjto1GFxlXutIs1WZX5AR
TLSH
T1B86523639CF240D7F62951B029C76BA1ECBBB307594920BB8B50ED190F3D064BE766E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.6MB
SHA256 8d73bdaed9b10e6b208e3a8596daaa4a0b5abb59cff930fd1a30c0270d86a246
MD5 c6b7acb1e9928be4ebc9d626346cd8a9
SHA1 bb8562d824b2f22268891b07439ac9e82adb7fb6
SHA512 1dbfaacb6f4cbfe04e09ce86b96b516af143f2998742a00161a041f5bd5f4b14a93235ca29f1396a296e26b2d60cdee132235e36b1d135e2204f13c0e278e006
SSDEEP 24576:VQwvik9RX6wkyAIEoHjto1GFxlXutIs1WZX5ARAMtZbR6SG3WRNfaHIe4HZxKsr8:gMnYIdT/M+wqMtL6uRhTnZrCfQ
TLSH
T1A3D5F129EFD844E1E177923C8DA3460AF6B178691B31D6CF0295536E0E37EE49D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 65f1af07ae8c70a42223228b6d2b5f839203e7b38fa871c98f7e8e292c695569
MD5 88244e5564708c3ed97d8cc2c24aeef4
SHA1 84ac5f6c263a8db344a21365bdbe5273317c8155
SHA512 fe509ee44e5dbbb432d8f8f17878a7e87409893126866f77901a9cb4adb69718501709d0de8e834936e942ebb2bbe73ae203870ffe1db677d26445d4a013e65c
SSDEEP 49152:rYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ET/M+w:PySzPOw
TLSH
T1AB066C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 ac64044695d7c8c15c6153898032dec3bd459d0305558fc3074a52145b321122
MD5 ada7734e5f89bbabfa73020704d4fdfb
SHA1 c87765e30b0eef96fc5af171b21a0a45ae118bcc
SHA512 f9d97a92ea3d9d05d78ff0618cba0152965d487016ca6bb1eb9ac57a86dd1226cc4bb9e7c1e1c491bb5a392a7a36e3c81673e776d49c9cb741a4c4406d4eb353
SSDEEP 24576:a47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYZoHjto1GFxlXutIs1WZX5AR:a47JUQj1irIhCnDHUPfF/0T/M+w
TLSH
T1F565AE1EA3EC01E5E1BA927885164A5AEA71742E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 23cf9007728919882636b270422991b2b301cc04a00c6e5af0aed0ec023a3891
MD5 01a97f18de138b0bcb398a27a977cf21
SHA1 3561b4795f1876f17acb66a8e93f5925be681f5a
SHA512 29bba04e2d86a1ad9202f71de611a6f2935d7cf1110a3144801ed2a8585d895f2c9f7442363308c44af256aeed740c0d6cb0e0c81a19a6353b3ef944cec5e6bc
SSDEEP 12288:nzsfyhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:C4oHjto1GFxlXutIs1WZX5AR
TLSH
T1A275F11AD2A401D9D06E6174CB865A41F7337D2647E193DB57C0F93E0F3A190AEEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 12KB
SHA256 68c635b4998922edc61aac123082f15e9dbf3d81ff9883064608b3564b0e4ccd
MD5 3c49be48e12fb38cdbdcd1193db6a812
SHA1 07a108e26eb57f2b9803bff4dba5e1818d14ebf9
SHA512 707f0570fb8c3a07d6833b74da51a21a37333676ffda25f08976a89a6df2b030f82a32e8657223a90d4c2753dfba6e20fe7204ef52f0a568375fdbc855570b08
SSDEEP 12:KX6/WVWEEEEEEEaCEqEEE7M1WvEEEME3sl:KX9wle
TLSH
T111425BD45B13AE3DD5599331095693781330D0476F46A7D70ACC20394D441DC5E4BB3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 e746891c4d58a23569c76e1364631c67f4714accf04ff368ef949844d9632fa4
MD5 ed5287a51a53e7feff1279656b5b8929
SHA1 a2739ceb697eec25cd61300a869aac0f16729568
SHA512 52b2e92df0d41cf0753b2ff13f3b594a3772adba54e847292838f1a7b7fc2c6f085011c81b085876168f4d7d46b37fb7a5a3f40bc5c543272a8bb90532bbeb1a
SSDEEP 12288:D+76hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY4N:2AoHjto1GFxlXutIs1WZX5ARxN
TLSH
T10465236399F254C7F57961B029DBAA31AC7FB3160F4410FB9A40EE190E3D0E0AE766D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0383e253bcd606715a9e65b52db5d91a0f1db5f2c3f94fa43984eeb8a0c496ad
MD5 8d8a9c864cc60df41f290fa69172ad08
SHA1 85eff968f614cbe0176b4c491c7a4564fb11a949
SHA512 72089a765a1bc8b57d924e5a6506e4a10263fc7666c0f4b2f9f1ac5f8dca2d7f5acf10fd2daaaf67310e432bab423a37e06ddea1efc442c77503f0137057bacc
SSDEEP 24576:Fgb6bmBIi49WNNFpg1rSvFv7bYmoHjto1GFxlXutIs1WZX5AR:Fgb4mBIBhGFyT/M+w
TLSH
T1B8659E1E22E802F5E1F9D2B89DAB4417D6B378160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 2.1MB
SHA256 b09f487bb05e25ffc4d3f4f791e9eda5a48e007bf346fdfb71e9243085abc9a9
MD5 2f6488db4cc67d673a84c46158782ecd
SHA1 3b98bec9ac71c7bc158d379d4c0314ce8936a268
SHA512 09dd59d52b2d28c47cda9cb3adcdd472e302a7610ed1e114d5642e386c81aa7006e6cedfaa188067e89ef7a5b42f579be6a808be4cb03b976f2e4e898d4b2198
SSDEEP 24576:xgb6bmBIi49WNNFpg1rSvFv7bYmoHjto1GFxlXutIs1WZX5AR8ZbR6SG3WRNfaHz:xgb4mBIBhGFyT/M+wqL6uRhTnZrCfQ
TLSH
T12DA5D01E62E801F5E1FAD2B88DA74417D6B378160732D2DF1251422D2F3BEE89D3AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 832KB
SHA256 fac351ce662008dc28710cecb13ae00a5669f8ca9143177da0177337ae1c1d27
MD5 3914456157628d1505fcdd88467db898
SHA1 34b14bbb4d4819d85b8bbe63b13a60e8f59ab681
SHA512 0df6bced092f6c68d84d2393390b4097fcd6224120b010e670767d1620984dc422e5fefb63f866cbd7663cf43b99715bc64f69c237bfb0d04154d0b81adcbca4
SSDEEP 12288:/OGH17UeR6SGnGRtOW0eNfcUMFHVOFe6Q8HOOxKsUpbZUqOr2NSARk/TtxIUzOoi:WGHZbR6SG3WRNfaHIe4HZxKsrCZRQwR
TLSH
T13D052328EAB928E0D279C73D45209706F5617072932AB9FF4AE181778B756F0A43BC64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 3097f4d040594e07caedcca88a887998d585cefa84214bfb7d928fbcb5cce83a
MD5 9bb71924688c4bcea63126230237d62d
SHA1 faabea79245164634f3bfb06cc007a23733d214b
SHA512 b57d368dd2d7f0677ee8aaac894e9b03c6b680331e9a4c7d97f21fb87fa50d855ba31e66e4b96fffe1873c65c7bafa53102916ce2655209ae3dc7462ace6ef94
SSDEEP 24576:ZG88u8FpJqH1xzria7/mJoHjto1GFxlXutIs1WZX5AR:M7ZFPqV4a7/vT/M+w
TLSH
T12295F16676E101F1D47BD13889874663F6B2B4250364EBEF0BA88F151F236E44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.8MB
SHA256 66cdec7ae3ce15d6cdb6af74f9e5e4e5e4ba0bc3749f9e5c257dbec54e3584a8
MD5 b23e43a4fa641a8be2238462167bf2d5
SHA1 d1691df68dd8573a85f4dd84ccab8ed1ea61fa2b
SHA512 322f968f24e3f93d5c82c6d02714efb6a5aa25805fd08b9affbf4ae18998d69cdde04bfeb53870989d196bc399dd8f6c28dc34774d0cca9d495012d852bb1538
SSDEEP 49152:SBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj8L6uRhTnZrCfQ:dG05lO43bBL64Ef
TLSH
T1FFD5C06AA2EC11F9D1BBD17CCAC6460BEBB23425033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d83895e1bfbb27a1e9c15f47404727cca21c6ae4400c54eec4a3b11fca139801
MD5 480123e19ad32403a18f0e419e717b19
SHA1 7071cb1e50752a679ddc8d3e514c66c91d60a4b8
SHA512 b1087271301a39d362f428951f20ed786dec526c38d8f5c9f24d801f3b0798bf1d38150726de22f07fc0edf5f454955e83d6c86f6e4e6074dae95f7e8323cd9c
SSDEEP 24576:Nfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn7oHjto1GFxlXutIs1WZX5AR:9a5POZ3+Jt2pasx2+mGT/M+w
TLSH
T1B565AF5EA6F801D5E579D17CC583461AF5B2342653319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 748c06267909cf1be5692cab48f56d5be2ae6b1c69fe2768c00a695e99a00894
MD5 4c43c3379386322039515136055e1a76
SHA1 b68446a7abad99541716aa19612d911f994587a1
SHA512 813d7b6844a99fc12d92bf85ce8c4b42be1a382bf01ea114e230c1cfafec5e8704976f70efac82d30b3f245347351414699347082f83d9ca91d62a00cb11926e
SSDEEP 24576:BNcwHdjbyQ4nLC18lb/EOjowL7FkBoHjto1GFxlXutIs1WZX5AR:BNc/zEOVHFPT/M+w
TLSH
T181858C2622E901E4F5BBE1BE89779546FA717865133086CF0291851F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 56a811b2e66544935d482488c2a1e609c2330e5236e2f7f554a127cf7d73205d
MD5 fdb79acb490758fabc2cd5b5dcc00281
SHA1 7555e5d26f9d24d8d64d8ad7134e4282bff53139
SHA512 1eefa50225187692f8da202cf6c675433640ddfeb010d15094c4a3b3d03b8c8d70d8e2d4c9bad32e8a7507ba5602b7f8a7a9efb173128d463719e2c2f23d27c9
SSDEEP 24576:06DIMZbR6SG3WRNfaHIe4HZxKsrCZRQwR:06DIML6uRhTnZrCfQ
TLSH
T12A25021CA77A10F5D16BD13E86924606E2B2B071C36669DF47E0C17A4EB3ED8B83DE50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 932KB
SHA256 bc7c77b6a50008cde9e78d4332a2da0d31c1832d6da74151d513317025152569
MD5 f06d20f8bbb54210c37cb62f2dc00960
SHA1 aa417d7346a8029ed06cd3079654949ecbcc7ff3
SHA512 50f2324c6974f2fd7e0c147883c39a855ee12d16008588cc5aa33600c74356f892262aa32f615465d8b76ee8e34a94de13ab017828bfb0730c4e127ad0aa4ae6
SSDEEP 24576:btykWzZbR6SG3WRNfaHIe4HZxKsrCZRQwR:btuL6uRhTnZrCfQ
TLSH
T138152300D7A854D1E7A9473C8A628345DA35BC319736B6EF56E0922F4F367E0E832B25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 804KB
SHA256 047e0ed82f46eb1b1a64a70acd552d7e06e1f0fa42e2e8bbdd854645854d570b
MD5 b287c457bea77068acb008db9a3905d5
SHA1 fed451a1b2b930b99b496e5bbee46a30d47ede37
SHA512 c8cee0b56b288c7d64517820e3a486170db8597bca61ff5fdd4ea52fdee48bcb27633677795d96b0b4fec7d9ef0c123f7c59545396ac67a33e0dc6433f8b7789
SSDEEP 12288:3OXIUg17UeR6SGnGRtOW0eNfcUMFHVOFe6Q8HOOxKsUpbZUqOr2NSARk/TtxIUzg:kgZbR6SG3WRNfaHIe4HZxKsrCZRQwR
TLSH
T1F2052324DF292CE2D349977D0620A70AE6167037977FB9EFAAF1416386712E0E437D24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 664KB
SHA256 7b73686d9aedb6ea4bd7834a6156ec57af8566df1fed31ab895825d157917963
MD5 a5c92e26842d84e08e578bcb4827a61a
SHA1 3ad64dddff28fd1d7d884fc77cbcad160fb8f69d
SHA512 267cbe8a33758c17a3819e4e283bfab3cb5b307149eaaaef0ec50da3ff181f8d0eb4474f2b03055366c4e57205462ef4fabe9d72f843da53c6f5a7d92c69c584
SSDEEP 6144:1kJgIxy5Z1PSLI+lqoDyMpJHS433NhcMV/VUjSTrGNPyCSZB8PTuFcKa45H9g+fk:1ggIuZRFDK3tT5Tr7aVLIH9lH3c
TLSH
T1DEE4F71D67EA05CAE2B2D279D8721493D633B4315772D6CF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 6d799a4b2eda3377f4884c1c803591a448be719e62cdfc68ffd59d9ef34efcaf
MD5 e3e627fbbbfdfba79bf8916fe8eb8c10
SHA1 fc0d2eee00e0c63bfd030b455f43b9f6bb419875
SHA512 f3cad15f90fafa2ac7327e8f30147903240a31ce9630e32eee79e654faf9072373fa8b7c727d57bbca1f977ffd584689371ae6272f20cc83fc42894c2f3d2e12
SSDEEP 24576:UTkNvNnaFeYhJNtmZBmTZbR6SG3WRNfaHIe4HZxKsrCZRQwR:UTMwBtOmTL6uRhTnZrCfQ
TLSH
T13075B02EBAB845E4D1FEC6B58E238512E6727461073293CB5390C13F4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1000KB
SHA256 071e999c2365656a6710b2dd558b546af8a09bb66ab0eb6ce3280593faf797e3
MD5 5427370f4905f42a5337fef3120c719c
SHA1 93e01fd8ded1fc3c4cd6268fafa0cd093f95ca71
SHA512 2d8f5a0940b9645bbc7656787e750ea1a27beaceedd74b55ce09b4b6aec936ce76b5dfef8d04665d4a9ed0cb5f3108f7a72033a9449ec1fca8ff6dcb3aa040a9
SSDEEP 24576:aPUr+NQ7ZbR6SG3WRNfaHIe4HZxKsrCZRQwR:aJQ7L6uRhTnZrCfQ
TLSH
T1E625F22E66AD1CE5E67AE17D85418709F77174621312E6CF02E0817F4E77AE8BC3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 2.6MB
SHA256 46098c86dceb4791597fe41c06df289fa05c665d041f41fbb70c44a375d3d565
MD5 525201c234d8e725fc3d4c05480e0307
SHA1 2f0ba8a20ce7de14f17bc55a41339257fc01de4d
SHA512 e1b07aac4901dd8ab6e64851f7e8e9114fe282b277c21e04f35d7cadb5a6ce895f67ac434c478f7022466b74f42ae467850c6c1bfca6aedd41a086b1be48aa86
SSDEEP 24576:ZD3FHshBIYQgAcoHjto1GFxlXutIs1WZX5ARjZbR6SG3WRNfaHIe4HZxKsrCZRQG:ZDVHeBIAA1T/M+wlL6uRhTnZrCfQ
TLSH
T111C5123DEAA804E5E57BD17C8A538A06E67234B9032665DB06D0C1760F3BEE47D3AF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 2376782182fde9c1d143227ea51617b8b1e70d1719f33f7ac22c15ef0452f896
MD5 05bbd897c87cd4fad0d9572d8b2db4bd
SHA1 a14d8739fb50f39ce778ebdf0b23416a2621d09a
SHA512 5a54318315ca8e9213303a1d7e962943bd84496695bdb0c2d62dfe938ced825168359c77086b4b072ebb61e3310fef2b24dda8dbd3e1edcdd61695923f22bd3e
SSDEEP 24576:1JnJPbzB4S1ZbR6SG3WRNfaHIe4HZxKsrCZRQwR:1JnJv6S1L6uRhTnZrCfQ
TLSH
T11235E13DD2A810E4E4B7C2B4811A175AFF31347D2B2669CB59B4D5353F12EE0A93AF18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 796KB
SHA256 0e48e25372014ae8bcc70b68e8d50a8c53393377202366bda74ffbee8c477091
MD5 47d21a92c05f74d190d4dcbce9257243
SHA1 aa1d3a6e641d17aae288247042a1e81411b70e47
SHA512 9e8d64f50a5b34522e287028f71889acffed1262852530c0e5c666cadc10ab876de1a7a6f495182b9c06d65594f7eba29674574139f150763c5915cc2bdf5e4c
SSDEEP 12288:aw17UeR6SGnGRtOW0eNfcUMFHVOFe6Q8HOOxKsUpbZUqOr2NSARk/TtxIUzOoAFT:awZbR6SG3WRNfaHIe4HZxKsrCZRQwR
TLSH
T14F052310DF695CE2E38A977E0A20A70AE645A03793BFB9DFAAF1414381752F0E437574
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 940KB
SHA256 75103aeaa2aa0357d3191d049912fbf69b8ebb39979ed0b760d2d48c71a4d560
MD5 b3708240fea99a66196aa02661e2532f
SHA1 0497fdc35a20ee9bf5e84e6b89dea0953e48cfe9
SHA512 edd521652d5324673fb917b9031327d46fe3085ef7cb92a8038706251affd461283919e05c00bda3b92b772c9ede24f08af54c6d0e637d2c291e95650f3e9cfc
SSDEEP 24576:N6UqjpQZbR6SG3WRNfaHIe4HZxKsrCZRQwR:N6U5L6uRhTnZrCfQ
TLSH
T11D25131DDB9418E5E17943388961830AD565B837537BB9EF76E0827B8B31AE0D43FE20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/692-416-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/692-454-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/692-424-0x0000000001380000-0x0000000001403000-memory.dmp

Download

memory/692-415-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/692-430-0x0000000001380000-0x0000000001403000-memory.dmp

Download

memory/692-422-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/1244-23-0x0000000004CB0000-0x0000000004D10000-memory.dmp

Download

memory/1244-85-0x0000000140000000-0x0000000140307000-memory.dmp

Download

memory/1244-0-0x0000000140000000-0x0000000140307000-memory.dmp

Download

memory/1244-1-0x0000000001290000-0x0000000001313000-memory.dmp

Download

memory/1244-8-0x0000000001290000-0x0000000001313000-memory.dmp

Download

memory/1244-7-0x0000000001290000-0x0000000001313000-memory.dmp

Download

memory/1244-14-0x0000000003250000-0x00000000032B0000-memory.dmp

Download

memory/1244-323-0x0000000140000000-0x0000000140307000-memory.dmp

Download

memory/1244-311-0x0000000004CB0000-0x0000000004D10000-memory.dmp

Download

memory/1244-314-0x0000000001290000-0x0000000001313000-memory.dmp

Download

memory/1244-313-0x0000000003250000-0x00000000032B0000-memory.dmp

Download

memory/1244-36-0x0000000004CB0000-0x0000000004D10000-memory.dmp

Download

memory/1244-22-0x0000000003250000-0x00000000032B0000-memory.dmp

Download

memory/1264-82-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/1264-56-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/1264-63-0x0000000002300000-0x0000000002360000-memory.dmp

Download

memory/1264-70-0x0000000002300000-0x0000000002360000-memory.dmp

Download

memory/1264-69-0x0000000002300000-0x0000000002360000-memory.dmp

Download

memory/1264-83-0x0000000002300000-0x0000000002360000-memory.dmp

Download

memory/2116-95-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2116-87-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2116-86-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/2116-393-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/2488-43-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2488-153-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2488-44-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2488-52-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3212-113-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3212-394-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3212-396-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3212-119-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3212-112-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3928-398-0x0000000140000000-0x000000014021F000-memory.dmp

Download

memory/3928-126-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3928-132-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3928-124-0x0000000140000000-0x000000014021F000-memory.dmp

Download

memory/4544-397-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4544-102-0x00000000009F0000-0x0000000000A57000-memory.dmp

Download

memory/4544-107-0x00000000009F0000-0x0000000000A57000-memory.dmp

Download

memory/4544-101-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4732-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4732-144-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4732-149-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4732-138-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4732-151-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5300-444-0x0000000001390000-0x0000000001413000-memory.dmp

Download

memory/5300-441-0x0000000140000000-0x0000000140388000-memory.dmp

Download

memory/5300-442-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5300-450-0x0000000001390000-0x0000000001413000-memory.dmp

Download

memory/5300-455-0x0000000140000000-0x0000000140388000-memory.dmp

Download

memory/5300-462-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5300-459-0x0000000001390000-0x0000000001413000-memory.dmp

Download

memory/5300-463-0x0000000140000000-0x0000000140388000-memory.dmp

Download

memory/5524-155-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5524-161-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5524-154-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5524-399-0x0000000140000000-0x0000000140172000-memory.dmp

Download